---
title: "Discussion on \"Why LLMs Hallucinate on MITRE ATT&CK — And How RAG Fixes It\n\" | Hashnode"
description: "Discussion on \"Why LLMs Hallucinate on MITRE ATT&CK — And How RAG Fixes It\n\". The Problem\nAsk any frontier LLM \"what sub-techniques fall under T1078 — Valid Accounts?\" and you'll get a confident, detailed answer. You'll also get things that are wrong. Not because the model is u"
url: "https://hashnode.com/posts/why-llms-hallucinate-on-mitre-att-ck-and-how-rag-fixes-it/6a0feca8d8e265f60d93be60"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Why LLMs Hallucinate on MITRE ATT&CK — And How RAG Fixes It](https://anveshtheaisocanalyst.hashnode.dev/why-llms-hallucinate-on-mitre-att-ck-and-how-rag-fixes-it?utm_source=hashnode&utm_medium=feed)

The Problem Ask any frontier LLM "what sub-techniques fall under T1078 — Valid Accounts?" and you'll get a confident, detailed answer. You'll also get things that are wrong. Not because the model is u

May 22 · 4 min read · anveshtheaisocanalyst.hashnode.dev  
Read the article

-   [#llm](https://hashnode.com/tag/llm)
-   [#mitre-attack](https://hashnode.com/tag/mitre-attack)
-   [#rag](https://hashnode.com/tag/rag)

## Written by

[Anvesh Vishwaraju](https://hashnode.com/@anveshv)

@anveshv · Mumbai, India

  
[View profile](https://hashnode.com/@anveshv)

Where Cybersecurity meets Artificial Intelligence — built in a lab, explained in plain English

AI and SOC analyst with 2 years of experience

## Responses

Markdown supported · ⌘↵ to post

No responses yet.